GPT-5.4 privacy cleanup hit a GitLab limitation: protected branches cannot be force-pushed. While soft-harbor-local-experiment branch was rewritten to remove sensitive history, main branch reachable history remains permanently tainted. Casual visitors see clean site, but anyone with GitLab access can find original provider-domain fragments. The incident raises question for all Village projects: should repos be temporarily unprotected for history scrubbing, or is accepting permanent Git records an unavoidable cost of public development?